<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_RE_1 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_RE_1
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2020-11-22
      </span>

                                                                        <span class="post-pubtime"> 本文共1.6k字 </span>

                                                                        <span class="post-pubtime">
        大约需要12min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/RE/" title="RE">
            <b>#</b> RE
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>刚入RE，话不多说，BUU简单RE题目WP如下：</p>
<p>[toc]</p>
<h2 id="1-easyre"><a href="#1-easyre" class="headerlink" title="1.easyre"></a>1.easyre</h2><p><img src="/2020/11/22/BUU-RE-1/1611942677535.png"><br>cmd打开，输入，发现输出错误，拖入IDA查看</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942727021.png"><br>其实直接看到flag，但还是具体来分析一下</p>
<p>首先输入两个输入两个int类型的数，然后比较，如果不相等，则跳转到loc_40152F，并输出sorry,youcan’t get flag；如果相等，则继续执行，输出flag。</p>
<p>反汇编代码如下：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942734753.png"><br>与之前分析的还是如出一辙。</p>
<h2 id="2-reverse1"><a href="#2-reverse1" class="headerlink" title="2.reverse1"></a>2.reverse1</h2><p>下载EXE，cmd打开，输入后发现输出wrong</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942756498.png"><br>拖入IDA打开后发现找不到入口，查找字符串发现有类似flag的东西，之后一个个函数查看，发现sub_140011bC0出有异样</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942767266.png"><br>关键代码第二个for循环处，大致含义是将str2字符串的字母o改为数字零（111和48的ASCII码分别为o和0，IDA中按R即可转换）</p>
<p>str2为：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942777705.png"><br>输入flag，正确：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942791062.png"></p>
<h2 id="3-reverse2"><a href="#3-reverse2" class="headerlink" title="3.reverse2"></a>3.reverse2</h2><p>下载打开后发现无后缀名，拖入winhex查看：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942967077.png"><br>是Linux下可执行文件，执行查看：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611942987299.png"><br>拖入IDA查看</p>
<p><img src="/2020/11/22/BUU-RE-1/1611943049792.png"></p>
<p>大致含义即为将i和r替换成为1，输入，得到flag。</p>
<p><img src="/2020/11/22/BUU-RE-1/1611943026550.png"></p>
<h2 id="4-内涵的软件"><a href="#4-内涵的软件" class="headerlink" title="4.内涵的软件"></a>4.内涵的软件</h2><p>下载文件，cmd打开</p>
<p><img src="/2020/11/22/BUU-RE-1/1611943947205.png"><br>拖入IDA查看</p>
<p><img src="/2020/11/22/BUU-RE-1/1611943954349.png"><br>直接可以看到flag，但还是分析一波</p>
<p><img src="/2020/11/22/BUU-RE-1/1611943973271.png"></p>
<p>额。。好像和v2没啥关系。。flag对就完事了</p>
<h2 id="5-新年快乐"><a href="#5-新年快乐" class="headerlink" title="5.新年快乐"></a>5.新年快乐</h2><p>下载EXE后运行</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944012727.png"><br>拖入IDA发现有壳，peid查壳</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944029428.png"><br>upx -d 脱壳</p>
<p>&#x2F;&#x2F; 刚学PE没多久，upx壳的话。。先往后稍稍，这个是网上查的。</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944044865.png"></p>
<p>拖入ida</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944051904.png"><br>得到flag</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944063551.png"></p>
<h2 id="6-BJDCTF2nd-guessgame"><a href="#6-BJDCTF2nd-guessgame" class="headerlink" title="6.[BJDCTF2nd]guessgame"></a>6.[BJDCTF2nd]guessgame</h2><p><img src="/2020/11/22/BUU-RE-1/1611944071933.png"><br>shift+F12直接看到flag。。。</p>
<h2 id="7-helloworld"><a href="#7-helloworld" class="headerlink" title="7.helloworld"></a>7.helloworld</h2><p>没学过apk逆向，网上翻了下其他的wp，apkkiller打开</p>
<p>字符串中看到flag：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944083236.png"></p>
<h2 id="8-XOR"><a href="#8-XOR" class="headerlink" title="8.XOR"></a>8.XOR</h2><p>拖入IDA</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944090802.png"><br>global：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944099397.png"><br>shift+e提取：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944107263.png"><br>代码如下：<br><img src="/2020/11/22/BUU-RE-1/1611944167380.png"></p>
<p>第一次自己写，不会py，所以用c写的，也就那样，凑合着看吧…</p>
<h2 id="9-reserve3"><a href="#9-reserve3" class="headerlink" title="9.reserve3"></a>9.reserve3</h2><p>下载打开</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944177952.png"><br>丢进IDA</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944186032.png"><br>经过一个sub_4110BE函数，然后for循环，之后再与str2比较，str2如下：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944205348.png"><br>跟进sub_4110BE:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> *__cdecl <span class="title">sub_411AB0</span><span class="params">(<span class="keyword">char</span> *a1, <span class="keyword">unsigned</span> <span class="keyword">int</span> a2, <span class="keyword">int</span> *a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// STE0_4</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// STE0_4</span></span><br><span class="line">  <span class="keyword">int</span> v6; <span class="comment">// STE0_4</span></span><br><span class="line">  <span class="keyword">int</span> v7; <span class="comment">// [esp+D4h] [ebp-38h]</span></span><br><span class="line">  <span class="keyword">signed</span> <span class="keyword">int</span> i; <span class="comment">// [esp+E0h] [ebp-2Ch]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v9; <span class="comment">// [esp+ECh] [ebp-20h]</span></span><br><span class="line">  <span class="keyword">int</span> v10; <span class="comment">// [esp+ECh] [ebp-20h]</span></span><br><span class="line">  <span class="keyword">signed</span> <span class="keyword">int</span> v11; <span class="comment">// [esp+ECh] [ebp-20h]</span></span><br><span class="line">  <span class="keyword">void</span> *Dst; <span class="comment">// [esp+F8h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> *v13; <span class="comment">// [esp+104h] [ebp-8h]</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( !a1 || !a2 )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  v9 = a2 / <span class="number">3</span>;</span><br><span class="line">  <span class="keyword">if</span> ( (<span class="keyword">signed</span> <span class="keyword">int</span>)(a2 / <span class="number">3</span>) % <span class="number">3</span> )</span><br><span class="line">    ++v9;</span><br><span class="line">  v10 = <span class="number">4</span> * v9;</span><br><span class="line">  *a3 = v10;</span><br><span class="line">  Dst = <span class="built_in">malloc</span>(v10 + <span class="number">1</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !Dst )</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">  j_memset(Dst, <span class="number">0</span>, v10 + <span class="number">1</span>);</span><br><span class="line">  v13 = a1;</span><br><span class="line">  v11 = a2;</span><br><span class="line">  v7 = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">while</span> ( v11 &gt; <span class="number">0</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    byte_41A144[<span class="number">2</span>] = <span class="number">0</span>;</span><br><span class="line">    byte_41A144[<span class="number">1</span>] = <span class="number">0</span>;</span><br><span class="line">    byte_41A144[<span class="number">0</span>] = <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt; <span class="number">3</span> &amp;&amp; v11 &gt;= <span class="number">1</span>; ++i )</span><br><span class="line">    &#123;</span><br><span class="line">      byte_41A144[i] = *v13;</span><br><span class="line">      --v11;</span><br><span class="line">      ++v13;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( !i )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">switch</span> ( i )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:</span><br><span class="line">        *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(<span class="keyword">signed</span> <span class="keyword">int</span>)(<span class="keyword">unsigned</span> __int8)byte_41A144[<span class="number">0</span>] &gt;&gt; <span class="number">2</span>];</span><br><span class="line">        v4 = v7 + <span class="number">1</span>;</span><br><span class="line">        *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[((byte_41A144[<span class="number">1</span>] &amp; <span class="number">0xF0</span>) &gt;&gt; <span class="number">4</span>) | <span class="number">16</span> * (byte_41A144[<span class="number">0</span>] &amp; <span class="number">3</span>)];</span><br><span class="line">        *((_BYTE *)Dst + v4++) = aAbcdefghijklmn[<span class="number">64</span>];</span><br><span class="line">        *((_BYTE *)Dst + v4) = aAbcdefghijklmn[<span class="number">64</span>];</span><br><span class="line">        v7 = v4 + <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:</span><br><span class="line">        *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(<span class="keyword">signed</span> <span class="keyword">int</span>)(<span class="keyword">unsigned</span> __int8)byte_41A144[<span class="number">0</span>] &gt;&gt; <span class="number">2</span>];</span><br><span class="line">        v5 = v7 + <span class="number">1</span>;</span><br><span class="line">        *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[<span class="number">1</span>] &amp; <span class="number">0xF0</span>) &gt;&gt; <span class="number">4</span>) | <span class="number">16</span> * (byte_41A144[<span class="number">0</span>] &amp; <span class="number">3</span>)];</span><br><span class="line">        *((_BYTE *)Dst + v5++) = aAbcdefghijklmn[((byte_41A144[<span class="number">2</span>] &amp; <span class="number">0xC0</span>) &gt;&gt; <span class="number">6</span>) | <span class="number">4</span> * (byte_41A144[<span class="number">1</span>] &amp; <span class="number">0xF</span>)];</span><br><span class="line">        *((_BYTE *)Dst + v5) = aAbcdefghijklmn[<span class="number">64</span>];</span><br><span class="line">        v7 = v5 + <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">        *((_BYTE *)Dst + v7) = aAbcdefghijklmn[(<span class="keyword">signed</span> <span class="keyword">int</span>)(<span class="keyword">unsigned</span> __int8)byte_41A144[<span class="number">0</span>] &gt;&gt; <span class="number">2</span>];</span><br><span class="line">        v6 = v7 + <span class="number">1</span>;</span><br><span class="line">        *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[<span class="number">1</span>] &amp; <span class="number">0xF0</span>) &gt;&gt; <span class="number">4</span>) | <span class="number">16</span> * (byte_41A144[<span class="number">0</span>] &amp; <span class="number">3</span>)];</span><br><span class="line">        *((_BYTE *)Dst + v6++) = aAbcdefghijklmn[((byte_41A144[<span class="number">2</span>] &amp; <span class="number">0xC0</span>) &gt;&gt; <span class="number">6</span>) | <span class="number">4</span> * (byte_41A144[<span class="number">1</span>] &amp; <span class="number">0xF</span>)];</span><br><span class="line">        *((_BYTE *)Dst + v6) = aAbcdefghijklmn[byte_41A144[<span class="number">2</span>] &amp; <span class="number">0x3F</span>];</span><br><span class="line">        v7 = v6 + <span class="number">1</span>;</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  *((_BYTE *)Dst + v7) = <span class="number">0</span>;</span><br><span class="line">  <span class="keyword">return</span> Dst;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>感觉挺像base64，而且 </p>
<p><img src="/2020/11/22/BUU-RE-1/1611944219878.png"><br>那应该是就是了，恰巧之前了解过base64，具体如下：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944226944.png"><br>不会py，还是c</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944234753.png"><br>，之后base64 解密得到flag</p>
<h2 id="10-不一样的flag"><a href="#10-不一样的flag" class="headerlink" title="10.不一样的flag"></a>10.不一样的flag</h2><p>下载打开：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944240627.png"></p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v3; <span class="comment">// [esp+17h] [ebp-35h]</span></span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+30h] [ebp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [esp+34h] [ebp-18h]</span></span><br><span class="line">  <span class="keyword">signed</span> <span class="keyword">int</span> v6; <span class="comment">// [esp+38h] [ebp-14h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+3Ch] [ebp-10h]</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// [esp+40h] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  __main();</span><br><span class="line">  v4 = <span class="number">0</span>;</span><br><span class="line">  v5 = <span class="number">0</span>;</span><br><span class="line">  qmemcpy(&amp;v3, _data_start__, <span class="number">0x19</span>u);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;you can choose one action to execute&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;1 up&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;2 down&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;3 left&quot;</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;4 right\n:&quot;</span>);</span><br><span class="line">    <span class="built_in">scanf</span>(<span class="string">&quot;%d&quot;</span>, &amp;v6);</span><br><span class="line">    <span class="keyword">if</span> ( v6 == <span class="number">2</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      ++v4;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> <span class="keyword">if</span> ( v6 &gt; <span class="number">2</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v6 == <span class="number">3</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        --v5;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( v6 != <span class="number">4</span> )</span><br><span class="line">LABEL_13:</span><br><span class="line">          <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">        ++v5;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v6 != <span class="number">1</span> )</span><br><span class="line">        <span class="keyword">goto</span> LABEL_13;</span><br><span class="line">      --v4;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">1</span>; ++i )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( *(&amp;v4 + i) &lt; <span class="number">0</span> || *(&amp;v4 + i) &gt; <span class="number">4</span> )</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( *(&amp;v8 + <span class="number">5</span> * v4 + v5 - <span class="number">41</span>) == <span class="string">&#x27;1&#x27;</span> )</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">    <span class="keyword">if</span> ( *(&amp;v8 + <span class="number">5</span> * v4 + v5 - <span class="number">41</span>) == <span class="string">&#x27;#&#x27;</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;\nok, the order you enter is the flag!&quot;</span>);</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>


<p><img src="/2020/11/22/BUU-RE-1/1611944248419.png"><br>之前做过一道走迷宫的题，感觉挺像，而且：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944255968.png"><br>只要是1就退出，是#就puts()</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">*1111</span><br><span class="line">01000</span><br><span class="line">01010</span><br><span class="line">00010</span><br><span class="line">1111#</span><br></pre></td></tr></table></figure>

<p>就是走迷宫，得到flag.</p>
<h2 id="11-SimpleRev"><a href="#11-SimpleRev" class="headerlink" title="11.SimpleRev"></a>11.SimpleRev</h2><p>拖入ida看，</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span>                         </span></span><br><span class="line"><span class="function"></span>&#123;                                                                                                   </span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// eax                                                                                    </span></span><br><span class="line">  <span class="keyword">char</span> v4; <span class="comment">// [rsp+Fh] [rbp-1h]                                                                     </span></span><br><span class="line">                                                                                                    </span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )                                                                                       </span><br><span class="line">  &#123;                                                                                                 </span><br><span class="line">    <span class="keyword">while</span> ( <span class="number">1</span> )                                                                                     </span><br><span class="line">    &#123;                                                                                               </span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Welcome to CTF game!\nPlease input d/D to start or input q/Q to quit this program: &quot;</span>, argv, envp);</span><br><span class="line">      v4 = getchar();                                                                               </span><br><span class="line">      <span class="keyword">if</span> ( v4 != <span class="number">100</span> &amp;&amp; v4 != <span class="number">68</span> )                                                                  </span><br><span class="line">        <span class="keyword">break</span>;                                                                                      </span><br><span class="line">      Decry();                                                                                      </span><br><span class="line">    &#125;                                                                                               </span><br><span class="line">    <span class="keyword">if</span> ( v4 == <span class="number">113</span> || v4 == <span class="number">81</span> )                                                                    </span><br><span class="line">      Exit();                                                                                       </span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Input fault format!&quot;</span>);                                                                    </span><br><span class="line">    v3 = getchar();                                                                                 </span><br><span class="line">    <span class="built_in">putchar</span>(v3);                                                                                    </span><br><span class="line">  &#125;                                                                                                 </span><br><span class="line">&#125;          </span><br></pre></td></tr></table></figure>

<p>关键代码是Decry()</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">Decry</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v1; <span class="comment">// [rsp+Fh] [rbp-51h]</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+10h] [rbp-50h]</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [rsp+14h] [rbp-4Ch]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+18h] [rbp-48h]</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [rsp+1Ch] [rbp-44h]</span></span><br><span class="line">  <span class="keyword">char</span> src[<span class="number">8</span>]; <span class="comment">// [rsp+20h] [rbp-40h]</span></span><br><span class="line">  __int64 v7; <span class="comment">// [rsp+28h] [rbp-38h]</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// [rsp+30h] [rbp-30h]</span></span><br><span class="line">  __int64 v9; <span class="comment">// [rsp+40h] [rbp-20h]</span></span><br><span class="line">  __int64 v10; <span class="comment">// [rsp+48h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">int</span> v11; <span class="comment">// [rsp+50h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v12; <span class="comment">// [rsp+58h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v12 = __readfsqword(<span class="string">&#x27;(&#x27;</span>);</span><br><span class="line">  *(_QWORD *)src = <span class="string">&#x27;SLCDN&#x27;</span>;</span><br><span class="line">  v7 = <span class="number">0LL</span>;</span><br><span class="line">  v8 = <span class="number">0</span>;</span><br><span class="line">  v9 = <span class="string">&#x27;wodah&#x27;</span>;</span><br><span class="line">  v10 = <span class="number">0LL</span>;</span><br><span class="line">  v11 = <span class="number">0</span>;</span><br><span class="line">  text = join(key3, (<span class="keyword">const</span> <span class="keyword">char</span> *)&amp;v9);         <span class="comment">// text = killshadow</span></span><br><span class="line">  <span class="built_in">strcpy</span>(key, key1);</span><br><span class="line">  <span class="built_in">strcat</span>(key, src);                             <span class="comment">// key = ADSFKNDCLS</span></span><br><span class="line">  v2 = <span class="number">0</span>;</span><br><span class="line">  v3 = <span class="number">0</span>;</span><br><span class="line">  getchar();</span><br><span class="line">  v5 = <span class="built_in">strlen</span>(key);                             <span class="comment">// v5长度 10</span></span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt; v5; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( key[v3 % v5] &gt; <span class="number">64</span> &amp;&amp; key[v3 % v5] &lt;= <span class="number">90</span> )<span class="comment">//大小写转换</span></span><br><span class="line">      key[i] = key[v3 % v5] + <span class="number">32</span>;               <span class="comment">// key = adsfkndcls</span></span><br><span class="line">    ++v3;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Please input your flag:&quot;</span>, src);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    v1 = getchar();</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="string">&#x27;\n&#x27;</span> )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="string">&#x27; &#x27;</span> )                            <span class="comment">//如果getchar为空格，v2加1</span></span><br><span class="line">    &#123;</span><br><span class="line">      ++v2;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v1 &lt;= <span class="string">&#x27;`&#x27;</span> || v1 &gt; <span class="string">&#x27;z&#x27;</span> )              <span class="comment">// 如果v1不是小写字母</span></span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( v1 &gt; <span class="string">&#x27;@&#x27;</span> &amp;&amp; v1 &lt;= <span class="string">&#x27;Z&#x27;</span> )            <span class="comment">// 如果v1为大写字母</span></span><br><span class="line">          str2[v2] = (v1 - <span class="number">39</span> - key[v3++ % v5] + <span class="number">97</span>) % <span class="number">26</span> + <span class="number">97</span>;<span class="comment">// 处理str2[v2],转换为小写字母</span></span><br><span class="line"></span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span>                                      <span class="comment">// 如果是小写字母</span></span><br><span class="line">      &#123;</span><br><span class="line">        str2[v2] = (v1 - <span class="number">39</span> - key[v3++ % v5] + <span class="number">97</span>) % <span class="number">26</span> + <span class="number">97</span>;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">if</span> ( !(v3 % v5) )</span><br><span class="line">        <span class="built_in">putchar</span>(<span class="string">&#x27; &#x27;</span>);</span><br><span class="line">      ++v2;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( !<span class="built_in">strcmp</span>(text, str2) )                    <span class="comment">// 如果两个值相同，则congratulation</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Congratulation!\n&quot;</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Try again!\n&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">40u</span>) ^ v12;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>其中的join()：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944270424.png"><br>代码：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944276195.png"><br>这个代码我这个菜狗写了半天，再看看人家py的代码短的一批，py要赶紧学了….</p>
<h2 id="12-Java逆向解密"><a href="#12-Java逆向解密" class="headerlink" title="12.Java逆向解密"></a>12.Java逆向解密</h2><p>不太会Java，看了看网上WP说是要jd-gui的一个软件，打开：</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944284662.png"><br>Java不太会，差不多就是逐个将输入的字符加上@的ascii码再异或32，然后和KEY比较，</p>
<p><img src="/2020/11/22/BUU-RE-1/1611944291112.png"><br>目前就先干这么多吧，赶紧先把py学一学，用c写代码太…</p>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2020/11/21/python__re%E6%A8%A1%E5%9D%97%E4%B8%8E%E6%AD%A3%E5%88%99%E8%A1%A8%E8%BE%BE%E5%BC%8F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2020-11-22
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/RE/" title="RE">
              <b>#</b> RE
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2020/11/23/python__requestsocket%E6%A8%A1%E5%9D%97/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-easyre"><span class="toc-text">1.easyre</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-reverse1"><span class="toc-text">2.reverse1</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-reverse2"><span class="toc-text">3.reverse2</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-%E5%86%85%E6%B6%B5%E7%9A%84%E8%BD%AF%E4%BB%B6"><span class="toc-text">4.内涵的软件</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#5-%E6%96%B0%E5%B9%B4%E5%BF%AB%E4%B9%90"><span class="toc-text">5.新年快乐</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#6-BJDCTF2nd-guessgame"><span class="toc-text">6.[BJDCTF2nd]guessgame</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#7-helloworld"><span class="toc-text">7.helloworld</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#8-XOR"><span class="toc-text">8.XOR</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#9-reserve3"><span class="toc-text">9.reserve3</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#10-%E4%B8%8D%E4%B8%80%E6%A0%B7%E7%9A%84flag"><span class="toc-text">10.不一样的flag</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#11-SimpleRev"><span class="toc-text">11.SimpleRev</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#12-Java%E9%80%86%E5%90%91%E8%A7%A3%E5%AF%86"><span class="toc-text">12.Java逆向解密</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_RE_1 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2020%2F11%2F22%2FBUU-RE-1%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2020/11/22/BUU-RE-1/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
